Add Tramp support for yubikey (bug#49714)

* lisp/net/tramp.el (tramp-yubikey-regexp): New defcustom.
(tramp-action-show-and-confirm-message): New defun.

* lisp/net/tramp-sh.el (tramp-actions-before-shell)
(tramp-actions-copy-out-of-band): Add `tramp-yubikey-regexp' action.

2 files changed, 25 insertions, 0 deletions

diff --git a/lisp/net/tramp-sh.el b/lisp/net/tramp-sh.el
index f94508303df..41ab1045c24 100644
--- a/lisp/net/tramp-sh.el
+++ b/lisp/net/tramp-sh.el
@@ -519,6 +519,7 @@ shell from reading its init file."
     (tramp-yn-prompt-regexp tramp-action-yn)
     (tramp-terminal-prompt-regexp tramp-action-terminal)
     (tramp-antispoof-regexp tramp-action-confirm-message)
+    (tramp-yubikey-regexp tramp-action-show-and-confirm-message)
     (tramp-process-alive-regexp tramp-action-process-alive))
   "List of pattern/action pairs.
 Whenever a pattern matches, the corresponding action is performed.
@@ -536,6 +537,7 @@ corresponding PATTERN matches, the ACTION function is called.")
   '((tramp-password-prompt-regexp tramp-action-password)
     (tramp-wrong-passwd-regexp tramp-action-permission-denied)
     (tramp-copy-failed-regexp tramp-action-permission-denied)
+    (tramp-yubikey-regexp tramp-action-show-and-confirm-message)
     (tramp-process-alive-regexp tramp-action-out-of-band))
   "List of pattern/action pairs.
 This list is used for copying/renaming with out-of-band methods.
diff --git a/lisp/net/tramp.el b/lisp/net/tramp.el
index 093335a77b5..24953f751e9 100644
--- a/lisp/net/tramp.el
+++ b/lisp/net/tramp.el
@@ -698,6 +698,15 @@ The regexp should match at end of buffer."
   :version "27.1"
   :type 'regexp)
 
+;; Yubikey requires the user physically to touch the device with their
+;; finger.  We must tell it to the user.
+(defcustom tramp-yubikey-regexp
+  (regexp-quote "Confirm user presence for key .*")
+  "Regular expression matching yubikey confirmation message.
+The regexp should match at end of buffer."
+  :version "28.1"
+  :type 'regexp)
+
 (defcustom tramp-operation-not-permitted-regexp
   (concat "\\(" "preserving times.*" "\\|" "set mode" "\\)" ":\\s-*"
           (regexp-opt '("Operation not permitted") t))
@@ -4669,6 +4678,20 @@ The terminal type can be configured with `tramp-terminal-type'."
   (tramp-send-string vec tramp-local-end-of-line)
   t)
 
+(defun tramp-action-show-and-confirm-message (_proc vec)
+  "Show the user a message for confirmation.
+Wait, until the user has entered RET."
+  (save-window-excursion
+    (let ((enable-recursive-minibuffers t)
+          (stimers (with-timeout-suspend)))
+      (with-current-buffer (tramp-get-connection-buffer vec)
+        (tramp-message vec 6 "\n%s" (buffer-string))
+        (pop-to-buffer (current-buffer)))
+      (read-string "Press ENTER to continue")
+      ;; Reenable the timers.
+      (with-timeout-unsuspend stimers)))
+  t)
+
 (defun tramp-action-process-alive (proc _vec)
   "Check, whether a process has finished."
   (unless (process-live-p proc)